NASA/TM— 201 3-2 16552 



Design and Demonstration of Emergency Control 
Modes for Enhanced Engine Performance 


Yuan Liu 

N&R Engineering and Management Services, Parma Heights, Ohio 

Jonathan S. Litt and Ten-Huei Guo 
Glenn Research Center, Cleveland, Ohio 


September 2013 


NASA STI Program ... in Profile 


Since its founding, NASA has been dedicated to the 
advancement of aeronautics and space science. The 
NASA Scientific and Technical Information (STI) 
program plays a key part in helping NASA maintain 
this important role. 

The NASA STI Program operates under the auspices 
of the Agency Chief Information Officer. It collects, 
organizes, provides for archiving, and disseminates 
NASA’s STI. The NASA STI program provides access 
to the NASA Aeronautics and Space Database and 
its public interface, the NASA Technical Reports 
Server, thus providing one of the largest collections 
of aeronautical and space science STI in the world. 
Results are published in both non-NASA channels 
and by NASA in the NASA STI Report Series, which 
includes the following report types: 

• TECHNICAL PUBLICATION. Reports of 
completed research or a major significant phase 
of research that present the results of NASA 
programs and include extensive data or theoretical 
analysis. Includes compilations of significant 
scientific and technical data and information 
deemed to be of continuing reference value. 
NASA counterpart of peer-reviewed formal 
professional papers but has less stringent 
limitations on manuscript length and extent of 
graphic presentations. 

• TECHNICAL MEMORANDUM. Scientific 
and technical findings that are preliminary or 
of specialized interest, e.g., quick release 
reports, working papers, and bibliographies that 
contain minimal annotation. Does not contain 
extensive analysis. 

• CONTRACTOR REPORT. Scientific and 
technical findings by NASA-sponsored 
contractors and grantees. 


• CONFERENCE PUBLICATION. Collected 
papers from scientific and technical 
conferences, symposia, seminars, or other 
meetings sponsored or cosponsored by NASA. 

• SPECIAL PUBLICATION. Scientific, 
technical, or historical information from 
NASA programs, projects, and missions, often 
concerned with subjects having substantial 
public interest. 

• TECHNICAL TRANSLATION. English- 
language translations of foreign scientific and 
technical material pertinent to NASA’s mission. 

Specialized services also include creating custom 

thesauri, building customized databases, organizing 

and publishing research results. 

For more information about the NASA STI 

program, see the following: 

• Access the NASA STI program home page at 
http://www.sti. nasa.gov 

• E-mail your question to help@sti.nasa.gov 

• Fax your question to the NASA STI 
Information Desk at 443-757-5803 

• Phone the NASA STI Information Desk at 
443-757-5802 

• Write to: 

STI Information Desk 

NASA Center for AeroSpace Information 

7115 Standard Drive 

Hanover, MD 21076-1320 


NASA/TM— 201 3-2 16552 



Design and Demonstration of Emergency Control 
Modes for Enhanced Engine Performance 


Yuan Liu 

N&R Engineering and Management Services, Parma Heights, Ohio 

Jonathan S. Litt and Ten-Huei Guo 
Glenn Research Center, Cleveland, Ohio 


Prepared for the 

49th Joint Propulsion Conference and Exhibit 
cosponsored by AIAA, ASME, SAE, and ASEE 
San Jose, California, July 14-17, 2013 


National Aeronautics and 
Space Administration 


Glenn Research Center 
Cleveland, Ohio 44135 


September 2013 


Acknowledgments 


This work was sponsored by the Aviation Safety Program at the NASA Glenn Research Center. 


Level of Review : This material has been technically reviewed by technical management. 


Available from 


NASA Center for Aerospace Information 
7115 Standard Drive 
Hanover, MD 21076-1320 


National Technical Information Service 
5301 Shawnee Road 
Alexandria, VA 223 1 2 


Available electronically at http://www.sti.nasa.gov 


Design and Demonstration of Emergency Control Modes for 
Enhanced Engine Performance 

Yuan Liu 

N&R Engineering and Management Services 
Parma Heights, Ohio 44130 

Jonathan S. Litt and Ten-Huei Guo 
National Aeronautics and Space Administration 
Glenn Research Center 
Cleveland, Ohio 44135 

Abstract 

A design concept is presented for developing control modes that enhance aircraft engine performance 
during emergency flight scenarios. The benefits of increased engine performance to overall vehicle 
survivability during these situations may outweigh the accompanied elevated risk of engine failure. The 
objective involves building control logic that can consistently increase engine performance beyond 
designed maximum levels based on an allowable heightened probability of failure. This concept is applied 
to two previously developed control modes: an overthrust mode that increases maximum engine thrust 
output and a faster response mode that improves thrust response to dynamic throttle commands. This 
paper describes the redesign of these control modes and presents simulation results demonstrating both 
enhanced engine performance and robust maintenance of the desired elevated risk level. 

Nomenclature 


C-MAPSS40k 

Commercial Modular Aero-Propulsion System Simulation 40k 

EPR 

Engine pressure ratio 

FAA 

Federal Aviation Administration 

HPC 

High-pressure compressor 

HPT 

High-pressure turbine 

LPC 

Low-pressure compressor 

LPT 

Low-pressure turbine 

max 

Maximum 

min 

Minimum 

Nc 

Core speed 

W 

Fan speed 

OT 

Overthrust 

PC 

Power code 

PLA 

Power lever angle 

PR 

Pressure ratio 

PR S 

Stall pressure ratio 

Ps30 

Combustor inlet static pressure 

R 

Rankine 

R 2 

Goodness of fit 

rpm 

Revolutions per minute 
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RU 

SM 

T40 

T48 

T50 

VBV 

vsv 


Ratio unit (ratio of fuel flow rate to Ps30 ) 
Stall margin 

HPT inlet total temperature 
LPT inlet total temperature 
LPT exit total temperature 
Variable bleed valve 
Variable stator vanes 


1.0 Introduction 

Commercial aircraft engines are designed to abide by strict safety standards. Enforced by regulatory 
bodies such as the Federal Aviation Administration (FAA), these requirements impose limits on the 
probability of various types of engine component failure. These limits are manifested as restrictions on 
engine operating variables such as rotational speeds, temperatures, pressures, and stall margins. However, 
in certain emergency flight scenarios, it may be more beneficial for overall vehicle survivability if certain 
safety parameters were relaxed to allow for non-standard usage of the propulsion systems. For example, a 
runway incursion event may cause a sudden reduction in available takeoff distance (Ref. 1). In such cases, 
it may be advantageous to have the option of temporarily increasing engine thrust output beyond the 
designed maximum level despite the accompanied elevated probability of powerplant failure. Moreover, 
there have been several instances of in-flight airframe malfunction or damage where flight crews resorted 
to engine throttle modulation to maintain aircraft control (Refs. 2 to 4). Such incidents have motivated 
research studies on throttle-only flight control, which identified the relatively slow dynamic response of 
gas turbine engines as one of the difficulties encountered (Refs. 5 and 6). Engine transient response is 
generally limited by conservative control algorithms designed to prevent compression system instabilities. 
However, in dire situations, a higher risk of compressor stall or surge may be an acceptable concession 
for increased thrust responsiveness. 

These considerations have motivated recent studies into intelligent risk management-based flight and 
propulsion control architectures (Ref. 7). Computer simulations of commercial-type turbofan engines 
were used to devise and assess methods of achieving additional engine performance (Refs. 8 and 9). 
Excess thrust output (overthrust) can be obtained by extending the control system target parameter 
(setpoint) beyond its default maximum value and relaxing spool speed and/or temperature limits. Engine 
transient response can be enhanced by modifying the controller bandwidth and acceleration schedule. 
Additionally, May et al. (Ref. 10) developed a novel control mode known as “high speed idle,” which 
improves transient performance by allowing the engine to operate at higher spool speeds while at idle 
thrust output levels. 

Complementary studies have been conducted to evaluate the risks of implementing the 
aforementioned control techniques. Litt et al. (Ref. 1 1) describe statistical methods that may be used to 
quantify the heightened likelihood of rotor disk/turbine blade failures and compressor instabilities due to 
overthrust and enhanced transient operation, respectively. Utilizing the underlying principles of these 
probabilistic methods, a somewhat qualitative risk assessment of the overthrust and faster response 
control modes was conducted at various engine operating conditions (Ref. 12) McGlynn et al. (Ref. 13) 
demonstrated through simulation the concept of a risk management architecture that combined this 
assessment of engine risk (due to enhanced performance) with one of situational risk (due to the specific 
nature of the emergency, e.g., vertical stabilizer damage). The two risk parameters were balanced to 
determine the conditions required for optimal (i.e., minimum) overall risk of an emergency scenario. 
Csank et al. (Ref. 14) documented a preliminary implementation of the overall control architecture, which 
integrated the enhanced performance control modes with the risk management logic. 
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The objective of the previously developed control modes was to achieve enhanced engine 
performance based on the selection of a range of allowable risk. However, these risk levels were 
qualitatively designated (e.g., low risk, medium risk, etc.). Hence, although it was shown that usage of the 
control modes resulted in a higher probability of engine malfunction, the magnitude of this increased 
likelihood at each risk level relative to that of normal engine operation is quantitatively ambiguous. 
Moreover, it is unclear from the previous studies whether or not the control modes consistently provided 
enhanced performance within the selected risk range across various operating points within the flight 
envelope. This paper presents and demonstrates, through use of a detailed computer simulation of a 
generic turbofan engine, a simple philosophy for designing and implementing these emergency engine 
control modes. At the crux of this concept is an a priori design decision: specification of an elevated and 
quantitatively meaningful probability of engine failure that is above levels representative of typical engine 
operation yet deemed acceptable during emergency flight scenarios. Since the analysis required for this 
specification is situation-dependent and, hence, beyond the scope of this work, a notional elevated risk 
threshold was adopted for illustrative purposes. Subsequently, the objective of the control mode 
algorithms is to constrain engine operation near but within this threshold when activated. The resulting 
engine performance represents the maximum enhancement achievable while satisfying these elevated 
constraints. The aforementioned overthrust and faster response control algorithms were leveraged and 
(at times, heavily) modified to demonstrate these notions. 


2.0 Design Objective 

The design of emergency control modes is centralized around the notion of improving engine 
performance at the cost of elevating the probability of failure. The types of engine failure under 
consideration should be particularly relevant to the nature of the performance parameter to be enhanced. 
Namely, the failure mode should correspond to the “weakest link” of the engine when operating beyond 
design capacities (see Ref. 1 1 for more details on this concept). For instance, the risk of turbine blade 
failure due to continued exposure to higher-than-normal temperatures is more pertinent to an overthrust 
control mode than one for faster dynamic response. 

This concept is best illustrated through a generic example. Figure 1 shows a collection of fictional 
risk data for some particular engine failure type. The black squares represent the probability of failure 
occurrence while operating the engine at the maximum attainable baseline performance for various 
operating points. As illustrated by this example, the risk of engine failure is expected to vary with 
operating conditions (altitude, Mach number, etc.). However, a maximum allowable probability for 
various failure types is generally defined by a regulatory body and cannot be exceeded. In this example, 
suppose the guidelines dictate that the probability of failure may not exceed 10“ 5 (blue dashed line). 
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Figure 1. — Notional illustration of emergency control mode performance. 
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For the emergency control modes, the designer must decide on an acceptable elevated failure rate. This 
increased threshold should be chosen such that overall vehicle survivability (for the emergency scenarios 
relevant to the control mode under consideration) is improved despite the higher risk of engine failure. The 
details of this balance between vehicle and engine risk is beyond the scope of this paper. However, 
McGlynn et al. (Ref. 13) provide examples of similar analyses. The elevated risk level depicted in Figure 1 
is 10" 3 (orange dashed line). The control mode should then be designed such that engine performance is 
increased until the elevated failure probability level is met. The red circles in Figure 1 represent the 
performance of a nearly ideal implementation of the hypothetical emergency control mode featured in this 
example. The risk of failure is consistently raised to approximately 10“ 3 at every operating point. 

3.0 Engine Simulation 

The demonstrations of the control modes developed according to this objective are conducted using a 
turbofan engine simulation called the Commercial Modular Aero-Propulsion System Simulation 40k 
(C-MAPSS40k) (Ref. 15). C-MAPSS40k is a zero-dimensional, nonlinear, dynamic model of a generic 
commercial aircraft engine implemented in the MATLAB/Simulink environment. The modeled 
powerplant is a 40,000-lb thrust class, high-bypass, dual-spool, turbofan engine. Figure 2 summarizes the 
layout of the major engine components. The fan and low-pressure compressor (LPC) are powered by the 
low-pressure turbine (LPT) through a low-speed shaft, and the high-pressure compressor (HPC) by the 
high-pressure turbine (HPT) via a high-speed shaft. The combustor model consists of a slight total 
pressure loss and an enthalpy rise based on the lower heating value of the fuel. The rotating components 
are modeled using unique performance maps (e.g., pressure ratio as a function of mass flow rate and 
corrected speed). Scaling factors, known as “health parameters,” for several map variables are available 
for each rotating component to simulate component faults or degradation. An overall engine deterioration 
level (ranging from 0 to 1) is available to automatically adjust these health parameters to model 
performance changes throughout the life of the engine (0 represents 50-hr engine; 1 represents end-of-life 
engine). The effects of variable stator vane (VSV) positions are accounted for by the HPC performance 
maps. There are two sources of compressor bleed air: a variable bleed valve (VBV) controls flow from 
the LPC to the bypass duct; HPC flow is used for turbine blade cooling and customer bleed. The 
rotational speeds of the two shafts are the state variables of the system, allowing for simulation of 
transient engine operation. 



Figure 2. — Layout of major turbofan engine components 
modeled by C-MAPSS40k simulation. 
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Figure 3. — Control system for C-MAPSS40k engine simulation. 


With the exception of ambient temperature and pressure, which are determined by flight conditions 
(altitude and Mach number), inputs to the engine model (fuel flow rate, VSV position, VBV position) are 
computed by a comprehensive control system. VSV and VBV commands are scheduled on sensed engine 
parameters such as spool speeds and inlet conditions. The control architecture for determining fuel flow 
(Figure 3) is more involved. The throttle command from the pilot, in degrees of power lever angle (PLA), 
is converted into a demanded value, or “setpoint,” of engine pressure ratio (EPR), which is the ratio of 
LPT exit to fan inlet total pressure. A scheduled-gain, proportional-integral, feedback controller calculates 
the fuel flow rate required by the engine to attain this demanded EPR level. The fuel flow signal is then 
passed through a series of limit regulators, which impose maximum and minimum restrictions on its 
value. This protection logic maintains the required nominal performance and corresponding risk of failure 
below the defined threshold, preventing engine malfunction due to issues such as combustor blowout, 
overspeed, and compressor stall. The resultant fuel flow signal is sent to an actuator model (not shown) 
that meters the appropriate flow rate to the engine. 


4.0 Overthrust Control Mode Design 

This section presents the design of an overthrust control mode according to the process described 
previously. The objective of the overthrust control mode is to operate the engine at thrust levels beyond 
the designed maximum level while conforming to a predefined acceptable probability of engine failure. 
Since the engine would be operating beyond normal thresholds, this failure risk would necessarily be 
higher than that for typical usage. Furthermore, this elevated failure probability determines the amount of 
additional performance the control mode can achieve. A brief overview is given of the legacy overthrust 
control algorithm that is used as the starting point for this work. For more detailed descriptions, the reader 
is referred to documentation of the control mode’s original development (Refs. 9, 12, and 14). 

4.1 Risk Function 

In order to build the overthrust control mode, it is necessary to characterize the probability of engine 
failure as a function of operating conditions. For simplicity, in this demonstration, we will consider only 
failures of compressor and turbine disks and turbine blades. The failure model, or “risk function,” used 
for this work is documented in Litt et al. (Ref. 1 1). It is important to note that although the risk function is 
based on published data, the values generated should be considered representative. The model calculates 
the probability of disk failure as a function of operation time and the size and rotational speed of the disk. 
The metric used throughout this work is failure probability per flight hour; hence, operation time is set to 
1 hr for all risk calculations in this study. Using the output values of fan speed ( Nf) and core speed ( Nc ) 
from C-MAPSS40k, the failure rate can be calculated for each disk corresponding to a row of compressor 
or turbine blades. The failure rates are then combined into a single risk value using basic probability 
theory (i.e., probability of at least one disk failing). Probability of turbine blade failure is determined by 
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applying relationships between material life and stresses from exposure to high centrifugal force and 
temperature. C-MAPSS40k does not model blade row performance. Instead, a linearly progressive 
extraction of enthalpy that empirically accounts for blade cooling flow is assumed, along with the 
component inlet and exit temperatures, to approximate the temperature at each blade row. Thus, the 
availability of shaft speeds (Nf, Nc ) and temperatures at the HPT inlet ( T40 ), LPT inlet (T48), and LPT 
exit ( T50 ) is sufficient to estimate the failure rates of all turbine blades. Again, the failure rates are 
combined into a single blade failure risk value (i.e., probability of at least one turbine blade failing). The 
disk and blade failure probabilities can be further combined into an overall failure risk (i.e., probability of 
failure of at least one disk or one turbine blade). This parameter is used to guide the overthrust control 
mode design. 

To ensure the risk function produces reasonable results, failure rates were calculated for the engine 
operating at maximum power (80.5° PLA) across both its flight envelope and operational life range. The 
risk function was applied at the altitude/Mach number combinations shown in Figure 4. For each point in 
Figure 4, variations were applied to the standard ambient temperature (0, +20 °R, and +40 °R from 
standard day) and the engine deterioration level (0, 0.5, and 1), for a grand total of 1,251 test points. The 
results, shown in Figure 5, are within FAA regulations, which allow a rate of occurrence of 10“ 7 to 10“ 5 
per flight hour for such failure types assuming they are contained (i.e., debris does not rupture through the 
nacelle) (Ref. 16). 



Figure 4. — Rotor disk/blade risk function tested at operating 
points across the flight envelope. Situations requiring 
overthrust are expected to occur at low-altitude/low-Mach 
number conditions. 
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Figure 5. — Rotor disk/blade failure rates as calculated by risk 
function across flight envelope and operating life range of engine. 
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For overthrust mode design, we defined the acceptable elevated failure level as 10“ 3 per flight hour. 
Namely, an ideal overthrust control mode would provide thrust levels that would result in a shift of each 
operating point shown in Figure 5 to a failure risk of lO" 3 . In practice, however, situations requiring 
enhanced engine performance are expected to occur at low-altitude and low-Mach number conditions 
(Figure 4). Hence, the control modes described in this work are, when applicable, tailored to this portion 
of the flight envelope. It follows that the results presented henceforth in this paper are primarily focused 
on this smaller operating regime as well. 

4.2 Modified Legacy Implementation 

This section describes the attempt to modify the legacy overthrust control algorithms (Refs. 9 and 12) 
to conform to the design objective prescribed in this work. The primary appeal of both the original and 
this modified approach is that they require minimal modifications to the baseline control architecture 
(Figure 3). The previous implementations of overthrust involved extending the EPR setpoint tables 
beyond the default maximum levels corresponding to 80.5° PLA. The EPR setpoint tables are used to 
convert PLA to EPR demand by interpolating between the setpoint flight conditions. The extended EPR 
setpoints corresponded to approximately 120 percent design maximum thrust output. The maximum fan 
and core speed limiters were disabled to allow this additional performance. 

The objective of this modified implementation is to provide overthrust while maintaining a consistent 
level of failure risk for a variety of operating conditions. Therefore, the risk function was used to reselect 
the elevated EPR setpoints. A set of 36 operating points at low altitude and Mach number (altitudes of 0, 
2000, and 4000 ft; Mach numbers of 0, 0.15, and 0.3; ambient temperature deviations of 0 °R and +40 °R; 
deterioration levels of 0 and l) 1 was chosen as extended setpoints for this approach. At each point, the 
engine was run with all maximum limiters deactivated except those for spool acceleration and combustor 
static pressure ( Ps30 ). EPR was then incremented until either the risk function indicated a failure 
probability of 10“ 3 or Ps30 reached its maximum allowable value (the Ps30 maximum limit prevents 
combustor failure, which is unaccounted for by the risk function). The resulting EPR values are saved as 
the elevated setpoints for overthrust operation. 

This approach was tested at 180 different flight conditions within the range of the extended EPR 
setpoints (altitudes of 0 to 4000 ft in 1000-ft increments; Mach numbers of 0 to 0.3 in 0.1 increments; 
ambient temperature deviations of 0 °R, +20 °R, and +40 °R; deterioration levels of 0, 0.5, and 1). 

Figure 6 compares the probability of failure for operating the engine at maximum power with and without 
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Figure 6. — Modified legacy overthrust implementation: failure probabilities. 


'it is assumed that engine deterioration level is known from sources such as maintenance logs detailing number 
of hours since overhaul or health estimation/management techniques. 
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Figure 7. — Modified legacy overthrust implementation: net thrust improvements. 


overthrust at each of those flight conditions. Figure 7 shows the percentage increase in net thrust at each 
operating point. 2 As expected, the level of additional thrust varies greatly with the flight condition — from 
approximately 4 percent to over 20 percent of baseline maximum thrust output. However, the overthrust 
mode designed using this modified method still performs poorly in terms of consistently delivering 
performance at the desired elevated failure risk of 10“ 3 . Analysis of the data revealed that the primary 
contributor to the lack of consistency is the fact that the maximum Ps30 limit was reached before a failure 
rate of 10“ 3 could be achieved for several of the extended EPR setpoints. This essentially invalidates the 
basic premise of using setpoint interpolation for a large portion of the operating envelope covered by 
these points. Furthermore, even for portions of the flight envelope where the Ps30 limit was not reached, 
the uncertainties introduced by interpolation manifested as relatively large deviations in failure rates. This 
issue was attributed to the high sensitivity of the failure model to certain engine parameters — an 
important observation to be elaborated upon in subsequent sections. A denser set of extended setpoints 
may alleviate this latter limitation but would not address the primary problem of Ps30 limit activation at 
some of the setpoints. 

4.3 Risk Boundary 

In an effort to obtain more consistent risk levels during enhanced performance operation, a new 
approach to overthrust was developed. This design places more emphasis on the disk and blade failure 
model. The premise is to calculate a boundary that represents a constant level of failure probability (in 
this case, 10“ 3 ). This boundary can be visualized as a surface in the multi-dimensional space defined by 
the input variables of the failure model. For instance, since the risk function used in this work requires 
five inputs (Nf Nc , T40 , T48 , T50 ), the boundary would ideally be a five-dimensional surface on which 
the failure probability remains constant at 10“ 3 . The overthrust mode would then manipulate the control 
system to maintain the operating point of the engine on this boundary. 

In order to simplify the definition and visualization of this failure boundary, the dimensions of the 
input space were reduced. To do so, the risk function was analyzed to identify the inputs it is most 
sensitive to. Furthermore, disk failure and blade failure were investigated separately. Recall from 


2 For the presentations of engine performance and risk at multiple operating conditions in these and subsequent 
figures, the operating points are not ordered in a physically meaningful fashion (unless explicitly stated otherwise). 
Therefore, observations will focus on the overall consistency of the performance and risk delivered by the control 
mode. No conclusions will be drawn about how engine performance — baseline or enhanced — trends with flight 
conditions. 
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Core Speed, RPM 

Figure 8. — Probability of disk failure as a function of core speed 
(neglecting fan speed). 


TABLE 1.— QUALITY OF LINEAR LEAST-SQUARES 
FIT BETWEEN TURBINE TEMPERATURE PAIRS 


Correlation 

Goodness of fit, 

(R 2 ) 

T40 and T48 

0.9955 

T40 and T50 

0.9598 

T48 and T50 

0.9739 


Section 4. 1 that the disk failure model requires spool speed inputs (Nf Nc ) whereas the blade failure 
model requires spool speeds and turbine temperatures ( T40 , T48 , T50). Not surprisingly, even in the 
neighborhood of maximum engine power operation, both functions were particularly sensitive to Nc and 
relatively unreactive to Nf due to the large difference in rotational speeds between the fan and core shafts. 
The analysis concluded that neglecting Nf would not have a significant impact for this work. For the disk 
failure calculation, this simplification reduces the model to a single- variable function (Figure 8). Hence, 
imposing a particular maximum allowable disk failure probability involves simply restricting Nc to the 
corresponding value. For example, a 10” 3 probability of at least one disk failure corresponds to core spool 
operation at over 13,200 rpm. 

The situation is more complicated with the blade failure model due to the turbine temperatures. 
Although the function is expectedly more reactive to the temperatures closely related to the hotter 
segments of the engine (in order of most to least sensitive: T40 , T48 , T50 ), it is sufficiently sensitive to all 
three variables such that none could be neglected. Thus, in an attempt to reduce the three temperatures to 
a single input value, a correlation study was conducted on steady-state turbine temperatures across the 
entire operating regime of the engine (at the 1,251 operating points described previously). It was found 
that the temperatures were highly linearly correlated; Table 1 summarizes the quality of the linear least- 
squares fits ( R 2 ) between different temperature pairs. Hence, knowledge of one temperature value can 
provide approximations of the other two. By using these correlations and neglecting fan speed, the input 
dimension of the blade failure risk function can be reduced to two (core speed and a turbine temperature). 
As an example, Figure 9 shows a failure boundary of 10“ 3 calculated in terms of core speed and T50. If 
the temperature correlations were perfect, operation on that threshold would result in a 1CT 3 probability of 
at least one turbine blade failing. The regions to the left and right of the boundary correspond to lower and 
higher risk levels, respectively. 

For this work, the elevated allowable probabilities for disk and blade failure were both set to 1(T 3 . 
Although this may theoretically result in a maximum probability of approximately 2^1 0“ 3 for overall 
failure (i.e., failure of at least one disk or blade), in practice, the two probabilities were orders of 
magnitude apart when operating at design maximum (or beyond) thrust levels. Spool speeds and turbine 
temperatures are interdependent parameters obtained by balancing a multitude of aerothermodynamic 
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Core Speed, RPM 


Figure 9. — Simplified boundary representing 10" 3 probability of 
blade failure in terms of core speed and T50 (neglecting fan 
speed and using linear correlations for T48 and T40). 

relationships. Simultaneous maximization of disk and blade failure probabilities (to 10“ 3 ) would require 
the contradictory scenario of operating at high core speeds (defined by Figure 8) and low turbine 
temperatures (to abide by the relationship in Figure 9). In other words, only a segment of the temperature/ 
speed boundary depicted in Figure 9 is realistically attainable. Hence, the elevated limit for overall 
disk/blade failure risk is still effectively 10“ 3 . 

It is important to note that, ideally, LPT exit temperature ( T50 ) should be used as the temperature 
input to determine the risk boundary since, of the three, it represents the most hospitable environment 
for sensor placement. Temperature measurements at the LPT inlet (T48) are available for certain aircraft 
engines (Ref. 17). 

However, HPT inlet temperature ( T40 ) is not typically measurable and would require performance 
estimation techniques. Nevertheless, we will analyze examples of overthrust using each of the three 
temperatures. As the results will illustrate, despite the highly correlated temperature relationships, the 
differences in R 2 values — albeit small — coupled with the high sensitivity of the failure model to the hotter 
turbine temperatures noticeably impact overthrust mode performance. 

4.4 Implementation With Risk Boundary 

Before examining the new overthrust control architecture, the transition process between normal and 
overthrust operation is briefly considered. Recall that in the C-MAPSS40k simulation, PLA is mapped to 
a set of target EPR values. PLA may also be interpreted as the physical position of the throttle component 
in the aircraft cockpit. Thus, extending the allowable range of PLA values for the purpose of overthrust is 
not practical. Instead, it is envisioned that the overthrust mode would be controlled via a dedicated button 
or switch. However, since this new overthrust mode is based on failure risk as opposed to EPR, a redefini- 
tion of the PLA-to-EPR mapping would be ambiguous. As a result, an intermediary power level indicator, 
known as power code (PC), is introduced. The PLA-to-EPR mapping within C-MAPSS40k is reformatted 
into a PC-to-EPR mapping. The relationship between PLA and PC is shown in Figure 10. During normal 
operation, the full range of PLA (40° to 80.5°) is mapped to PC values of 0 to 100. However, upon 
activation of the overthrust mode, PLA is matched to PC values of 0 to 110. The correspondence between 
the EPR setpoints and PC values from 0 to 100 is consistent for both normal and overthrust operation. PC 
values greater than 100 activate the overthrust mode, with a PC of 1 10 representing the thrust output at 
the maximum allowable elevated risk level of 10“ 3 . 
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Figure 10. — Definition of mapping from PLA to power code to 
facilitate transitions between normal and overthrust operation. 
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Figure 11. — Control mode architecture of overthrust implementation with risk boundary. 


The architecture of the risk boundary-based overthrust control mode is shown in Figure 11. Blocks 
outlined in black represent the baseline control system components whereas those in red indicate new 
components for implementing overthrust. The purpose of the overthrust mode is to calculate the fuel flow 
rate required to drive the engine operating point to the designated risk boundary. The control mode consists 
of three primary components: a core speed limiter, the risk boundary data, and a temperature limiter. The 
core speed limiter ensures that, even during overthrust, an absolute maximum value on core speed is not 
exceeded. This limit is defined by the disk failure risk of 10“ 3 . Concurrently, the pre-calculated risk 
boundary data (Figure 9, for example) is used to determine the maximum allowable turbine temperature for 
a given core speed. This temperature limit is recalculated as core speed varies. The temperature limiter 
determines the fuel flow required to drive the engine to that limit value. The minimum of the two limiter 
outputs is taken to ensure neither the disk nor blade failure threshold is violated. 

The remaining components introduced facilitate the transition process between normal and overthrust 
operation as described at the beginning of this section. The mapping from PLA to PC is dependent upon 
the mode of operation. For PC up to 100, the fuel flow rate is determined entirely by the baseline EPR 
controller (and the fan and core speed limiters). Between 100 and 110, the fuel flow signal sent to the 
remainder of the control system is a linear combination of the contributions from the EPR controller and 
the overthrust mode, weighted on PC. At maximum overthrust, or a PC of 1 10, the baseline fan and core 
speed limiters are essentially neglected and fuel flow rate is solely calculated by the overthrust mode. 
However, similar to the legacy overthrust implementation, the Ps30 limiter and acceleration schedule 
remain in the loop since the risk function does not account for their associated failure modes. The 
minimum limiters are preserved as well since they are not relevant to overthrust operation. 
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Core Speed, RPM 

Figure 12. — Overthrust implementation with Nc-T50 risk boundary: 
operating points relative to risk boundary. 


The question remaining is which of the three turbine temperatures to use with the overthrust control 
mode. The subsequent subsections present the results and issues associated with each case. 

4.4.1 T50 

This subsection presents the results of using T50 with the overthrust control architecture. As 
previously noted, this selection is the most practical since LPT exhaust gas temperatures are typically low 
enough to be readily measurable. This implementation is tested on the same 180 low altitude/low Mach 
number operating points described previously. Figure 12 shows the location of each operating point, with 
full overthrust, relative to the risk threshold by plotting T50 against Nc. As the results indicate, there are 
several flight conditions where the maximum Ps30 limit was activated before the risk boundary was 
reached. These points represent flight conditions where a failure probability, as calculated by the risk 
function, of 10“ 3 is not achievable due to the hard Ps30 limit; for these points, maximum overthrust is 
determined by the Ps30 limiter and usually corresponds to risk levels noticeably lower than the desired 
10“ 3 value. Most of the test cases (approximately 70 percent), however, fall onto the risk boundary as 
expected (note that the boundary shown in these results is a small section of the boundary depicted in 
Figure 9). Figure 13 shows the changes in net thrust from the design maximum output due to the 
overthrust mode. (For clarity, in these and subsequent figures illustrating overthrust mode performance, 
the operating points are ordered such that those with an active Ps30 limiter are plotted first.) The control 
mode achieved an increase in net thrust of 10 to 25 percent at nearly all 180 operating conditions 
regardless of the Ps30 limiter status. 

Despite the apparent success of this implementation suggested by the results in Figure 12, the actual 
failure probability levels for the test points are not necessarily close to 10“ 3 . Figure 14 shows the risk level 
for each run (before and after overthrust activation). These results confirm that the failure probabilities for 
most of the cases with an active maximum Ps30 limit remain well below 10“ 3 . However, the failure 
probabilities for the operating points on the risk boundary are inconsistent, varying by approximately an 
order of magnitude in both directions. This scatter is a result of the uncertainty created by collapsing the 
risk boundary into two dimensions. Recall that, in this case, the boundary was simplified by approximat- 
ing T40 and T48 using the linear least-square fits. Unfortunately, the high R 2 values of these fits are 
overshadowed by the sensitivity of the failure model to the hotter turbine temperatures — T40 , in 
particular. Figure 15 shows failure probability plotted against T40 error (difference between the actual 
T40 value and the T40 value calculated by applying the linear fit equation on T50) for only the points 
situated on the risk boundary. The test cases with small T40 discrepancies indeed exhibit failure rates 
close to the desired 10“ 3 level. However, a 20 °R error in T40 corresponds to approximately an order of 
magnitude change in probability of failure. 
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These results suggest that a risk boundary of lower failure probability should be used with the control 
mode if only T50 data are available. A more conservative boundary may be able to contain failure risk 
below the required level but will result in less-than-maximum performance in most cases. Alternatively, 
measurements or estimates of T48 or T40 could be utilized, which will be discussed in the subsequent 
section. 
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Figure 13. — Overthrust implementation with Nc-T50 risk boundary: 
net thrust improvements. 


-Q 

TO 

_Q 

O 

i_ 

Q_ 

CD 

i— 

3 


1.E+00 

l.E-01 

l.E-02 

l.E-03 

l.E-04 

l.E-05 

l.E-06 

l.E-07 


— — Baseline Risk 

— — Elevated Risk 


■ Baseline Max. 

O OT: Ps30 Active 



t 1 r 


0 20 40 60 80 100 120 140 160 180 


Operating Point 


Figure 14. — Overthrust implementation with Nc-T50 risk boundary: 
failure probabilities. 



Figure 15. — Overthrust implementation with Nc-T50 risk boundary: 
sensitivity of failure probability to T40 error. 
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4.4.2 T48 and T40 


Although the implementation with T50 data performed noticeably better than the modified legacy 
method in maintaining the desired elevated risk level (Figure 14 and Figure 6, respectively), there is 
ample room for improvement in terms of consistency. To address this issue, usage of the hotter turbine 
temperatures (T48 and T40) with this overthrust mode design was investigated. Because these 
temperatures represent harsher operating environments, they are not readily obtainable in all aircraft 
engine applications. Reference 17 suggests T48 is measurable for certain powerplants. However, T40 is 
generally unobtainable using conventional sensing devices. The implementations and results presented in 
this section assume either the availability of a T48 sensor or an accurate onboard estimation technique for 
T40 data. Measurement/estimation uncertainty was not analyzed, though, as shown by the results obtained 
using the T50 implementation, it would likely affect control mode performance. 

Figure 16, Figure 17, and Figure 18 show the results of applying the overthrust control mode using 
T48 data for the 180 test points. Figure 16 shows the 10" 3 failure rate boundary presented in terms of Nc 
and T48. Similar to the implementation with T50 , for each run, the control mode increased thrust output 
until the engine was limited by either the maximum allowable Ps30 value or the risk boundary. Figure 17 
summarizes the percentage increase in net thrust over the design maximum output levels. However, in 
this case, as shown in Figure 18, the actual failure probabilities of the runs situated on the risk boundary 
are distributed more closely around the 10“ 3 level (standard deviation of approximately 0.34xl(T 3 ). 



Figure 16. — Overthrust implementation with Nc-T48 risk boundary: 
operating points relative to risk boundary. 



Figure 17. — Overthrust implementation with Nc-T48 risk boundary: 
net thrust improvements. 
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Figure 18. — Overthrust implementation with Nc-T48 risk boundary: 
failure probabilities. 



Figure 19. — Overthrust implementation with Nc-T40 risk boundary: 
operating points relative to risk boundary. 


The primary cause for this deviation, albeit reduced, is the same as before: high sensitivity of the 
failure model to T40. Therefore, it follows that the failure probability consistency was further improved 
by utilizing T40 data with the overthrust control mode (Figure 19, Figure 20, and Figure 21). For this 
case, the standard deviation of the failure probabilities for those points located on the risk boundary was 
reduced to 0.066x1 0" 3 . This tighter distribution indicates that the Nc-T40 boundary is a more accurate 
approximation of the true (i.e., five-dimensional) constant failure rate threshold than the others. It is 
interesting to note that there are no significant differences among the three implementations with respect 
to thrust output enhancement. The primary advantage of the availability of the hotter turbine temperatures 
is more fine-tuned authority by the control mode over the failure probability. 

Although more complex than the legacy overthrust control mode architecture, this novel 
implementation is robust to flight conditions since its design is primarily based on the risk function. To 
demonstrate this (disregarding whether or not overthrust functionality would be useful at all such 
conditions), the control mode using T40 data was applied at the aforementioned 1,251 test points across 
the entire flight and engine health range of operation. Increases in net thrust output range from 2.5 to 
36 percent (Figure 22). Figure 23 shows that, with the exception of the cases with an active Ps30 limit, 
the desired elevated risk level is consistently maintained at all test points. 
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Figure 20. — Overthrust implementation with Nc-T40 risk boundary: 


net thrust improvements. 
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Figure 21. — Overthrust implementation with Nc-T40 risk boundary: 
failure probabilities. 
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Figure 22. — Overthrust implementation with Nc-T40 risk boundary 
(full envelope): net thrust improvements. 
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Figure 23. — Overthrust implementation with Nc-T40 risk boundary 
(full envelope): failure probabilities. 
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5.0 Faster Response Control Mode Design 

Application of the design method presented in this work to a faster engine response control mode 
requires identifying the type of malfunction to focus on and characterizing the probability of it occurring. 
This demonstration will concentrate on the risk of high-pressure compressor (HPC) rotating stall/surge 
(henceforth collectively referred to as “stall”) since the primary function of the faster response mode is to 
shorten engine acceleration times. Stall likelihood is captured by stall margin ( SM ), which is generally 
defined as the proximity of the operating pressure ratio (PR) of the compressor to its stall pressure ratio 
(PR S ) for the same operating mass flow rate: 


SM = 


PR J 


x 100 % 


(i) 


In C-MAPSS40k, the compressor maps and their corresponding surge lines are definitive quantities. 
Thus, it is usually assumed that stall does not occur if the stall margin is positive. However, in practice, 
there are uncertainties affecting both the operating and stall lines of a compressor that cannot be 
deterministically captured. If these random factors are accounted for, then the risk of stall exists even if 
the engine model reports a positive stall margin. The risk parameter used for the faster response control 
mode is this probability of HPC stall. 


5.1 Risk Function 

A statistical stability assessment is used to capture stall probability. The specific procedure and 
examples described in the “SAE AIR1419 Rev. A” guidelines document (Ref. 18) are leveraged for this 
work. Table 2 reproduces the data from the sample stability assessment provided by the document. The 
table enumerates factors that affect the operating and surge lines and provides approximations of how 
much stall margin is required to account for each. The sum of the non-random stall margin effects is an 
indication of the minimum design stall margin of the compressor. These factors are assumed to be 
accounted for in the design of the C-MAPSS40k engine model. Only the random effects are of interest for 
determining stall probability. 
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TABLE 2.— STATISTICAL COMPRESSOR STABILITY ASSESSMENT (Ref. 18) 


Operating line 

Destabilizing effects 

Non-random, 

percent 

Random, 

percent 

Inlet distortion 

0.7 


PLA transient 

6.0 


Fuel control tolerance 


±1.15 

Engine-to-engine variation 


±1.25 


Surge line 

Reynolds number 

0.36 


Inlet distortion 

7.5 


Engine-to-Engine variation 


±1.35 


Total | 14.56 | 2.17 



Figure 24. — Stall margins of a large fleet of engines modeled as 
normal distribution. Stall margin reported by C-MAPSS40k 
(1 percent in this illustration) represents mean performance. Area 
under curve from negative infinity to 0 equals probability of stall. 

The premise of the risk function is that the deterministic engine model, C-MAPSS40k, represents the 
mean performance of a large operating fleet of such engines. Deviations from this mean performance are 
approximated by a normal distribution function. The risk function calculates the stall probability by 
applying this assumption to stall margin. The offset and shape of the probability density function is 
defined by the deterministic and random stall margin effects. Specifically, the HPC stall margin output 
from C-MAPSS40k is set as the mean of the normal distribution. The random stall margin effects are 
combined using a root-sum-square calculation, resulting in the overall 2.17 percent value shown in the 
last line of Table 2. This root-sum-square is assumed to equal three standard deviations, thus defining the 
shape of the normal distribution curve. For instance, Figure 24 shows the stall margin distribution for a 
mean stall margin of 1 percent. The probability of stall at this particular operating condition is then 
obtained by calculating the area under the density function from 0 to negative infinity. These calculations 
are repeated for various values of mean stall margin to generate the risk function, visualized in Figure 25. 

For consistency with the overthrust control mode, a risk threshold of 10“ 3 was selected for the design 
of the faster response control mode. This risk level corresponds to a stall margin of approximately 
2.4 percent. As Figure 25 shows, the risk of stall is negligibly small for stall margins above 5 percent. 
Since the baseline engine consistently operates (during transients and at steady-state) at HPC stall margins 
well above 5 percent, the performance of the faster response control mode will be presented in terms of 
stall margin as opposed to stall probability. 
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Figure 25. — Probability of stall due to random destabilizing effects 
as a function of mean stall margin (reported by engine model). 


5.2 Implementation 

The legacy control mode implementation improved transient response by introducing three primary 
modifications to the engine control system (Ref. 10). First, the bandwidth of the EPR controller was 
increased to provide faster response for small PLA transients. Second, a novel high-speed idling 
technique manipulated customer bleed and stator vane schedules to attain higher spool speeds at low 
thrust levels. This operating state reduces the time required for the engine to reach higher power levels. 
Finally, the acceleration schedule was shifted to increase the limit on maximum allowable core 
acceleration, improving large transient performance at the cost of increased stall margin usage. 

For the present implementation, the controller bandwidth modifications and the high-speed idle 
algorithms were largely preserved. However, since the acceleration schedule plays a major role in 
regulating the stall margin usage during a large power transient, the offset logic was tuned using the stall 
risk function. A simple search algorithm was created to determine the offset amount that yielded a 
minimum stall margin of 2.4 percent during a 0.1 -sec flight idle-to-full power throttle change. This search 
was conducted at 60 operating points covering a low-altitude/Mach number flight regime (altitudes of 0 to 
4000 ft in 1000-ft increments; Mach numbers of 0, 0.1, and 0.2; 0 °R and +40 °R deviation from standard 
day ambient temperature; deterioration level of 0 and 1). Control mode usage within this envelope 
involved four-dimensional interpolation between these operating points to determine the appropriate 
offset value. 3 

To test the control mode, the same throttle transient was run at 540 operating points (altitudes of 0 to 
4000 ft in 500-ft increments; Mach numbers of 0 to 0.2 in 0.05 increments; standard day temperature 
deviations of 0 °R, +20 °R, and +40 °R; deterioration levels of 0, 0.3, 0.7, and 1) evenly distributed across 
the flight envelope defined by the 60 interpolation points. Figure 26 shows the minimum HPC stall 
margin observed during each run for the baseline control system and the faster response mode. The 
baseline cases exhibit a wide range of minimum stall margin values, indicating that the dynamic response 
is highly sensitive to ambient and engine health conditions. Nevertheless, the acceleration schedule 
performs its intended function, maintaining an often sizeable stall margin for all cases. With the faster 
response mode activated, this excess stall margin is consumed to improve transient performance. The 
control mode is relatively consistent in maintaining the desired minimum stall margin. 


3 A more direct method — analogous to the risk boundary overthmst implementation — would be a minimum 
limiter on HPC stall margin. Such an approach would require stall margin estimation (e.g., Kalman filter, model 
prediction, etc.) and, hence, is beyond the scope of this paper. However, the design philosophy presented in this 
paper is well-suited for this approach and implementation of such a configuration is a possible avenue of future 
work. 


NAS A/TM— 20 13-216552 


19 



0 

0 100 200 300 400 500 

Operating Point 


Figure 26. — Faster engine response implementation: minimum 
stall margin attained during transient. 
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Figure 27. — Faster engine response implementation: rise time 
improvements. 

The decrease in repeatability for the cases in the 180 to 360 range is due to interpolation of offset 
values across standard day temperature deviations. The 540 points in Figure 26 are grouped in order of 
increasing ambient temperature: the first third represents standard day ambient temperature; the second 
third is +20 °R deviation; the last third is +40 °R deviation. Since the interpolation points only consisted 
of conditions at 0 °R and +40 °R deviation, these results imply a nonlinear variation with standard 
temperature that is not being adequately captured by linear interpolation. It is expected that additional 
interpolation points at more temperature values would alleviate this issue. On the other hand, control 
mode performance across variations in altitude, Mach number, and engine health appears to be sufficient. 

Figure 27 shows the improvements in dynamic thrust response by using the control mode in terms of 
percentage reduction in rise time. For this application, rise time is defined as the time the engine takes to 
traverse from 10 to 90 percent of the difference between the initial and final thrust output levels. The faster 
response control mode achieves a 5 to 20 percent reduction in rise time for the majority of the test cases. 
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6.0 Joint Implementation 

The overthrust and faster response control modes operate on different components of the engine 
control system. As Figure 1 1 illustrated, the overthrust mode manipulates the limit protection (min/max) 
logic to incorporate the elevated risk boundary. On the other hand, the faster response mode modifies 
parameters within the EPR setpoint controller and acceleration schedule subsystems. Thus, the effort 
required to combine the two performance enhancing modes is minimal: the modifications introduced by 
each mode are superimposed without conflict. 

Likewise, engine performance when utilizing both emergency control modes is essentially a 
superposition of the results already presented for each control mode individually. This is because the two 
control modes seek to modify fundamentally separate portions of the engine response. To elucidate, 

Figure 28 shows the net thrust and HPC stall margin time responses to an idle-to-full-power throttle 
command for a particular operating condition (1000-ft altitude, Mach 0.2, +20 °R deviation from standard 
ambient temperature, 0.7 deterioration level). Four cases are presented: (1) both control modes 
deactivated (i.e., baseline); (2) overthrust mode only (using T40 data); (3) faster response mode only; (4) 
both control modes activated (with overthrust mode using T40 data). For the baseline and faster response- 
only cases, throttle was increased from flight idle to full power in 0.1 sec at the 15-sec mark; for the 
overthrust-only and combined implementation cases, throttle was increased from flight idle to full 
overthrust in 0.1 sec at the 15-sec mark. As shown by the results, the overthrust mode primarily affects 
the conditions at which the engine settles. The transient portions of the baseline and overthrust only cases 
are similar until the overthrust mode commands a higher thrust. On the other hand, the faster response 
mode significantly alters the dynamic response of the engine in the form of a shorter rise time and 
increased stall margin usage. However, the faster response and baseline cases settle to identical 
conditions. The joint implementation exhibits the characteristics of both control modes. The dynamic 
portion of the response resembles the faster response time history since the combined implementation 
drops to a similar minimum HPC stall margin. The response then settles to the same thrust level as the 
overthrust case. 

The results shown in Figure 28 are representative of the enhanced performance obtained throughout 
the low-altitude/low-Mach number operating regime described in the previous section. Figure 29 shows 
the minimum stall margins attained during a 0.1 -sec transient from flight idle to maximum overthrust at 
the same 540 operating points used to test the faster engine response mode. In this case, the joint 
implementation is compared with an overthrust-only configuration. Figure 30 summarizes the rise time 
improvements at those operating points. The results are similar to the comparisons between the baseline 
control system and the faster response control mode. Plots of steady-state net thrust improvements and 
increased disk/blade risk levels using the joint implementation are identical to the overthrust-only 
configuration (Figure 20 and Figure 21). 
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Figure 28. — Engine performance using combined implementation 
exhibits characteristics of both overthrust and faster response 
control modes. 
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Figure 29. — Combined implementation: minimum stall 
margin attained during transient. 
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Figure 30. — Combined implementation: rise time improvements. 


NAS A/TM— 20 13-216552 


22 


7.0 Summary and Future Work 

This paper described and demonstrated a design philosophy for developing engine performance- 
enhancing control modes for use during emergency flight scenarios. Performance improvements are 
defined and limited by a predetermined elevated risk of engine failure that is deemed acceptable for such 
situations where overall vehicle survivability must be maximized. This concept was demonstrated on two 
previously studied enhanced engine performance modes: overthrust and faster response. The overthrust 
control mode must be able to consistently provide increased maximum engine thrust output at a 
predefined elevated probability of rotor disk/blade failure for a variety of flight conditions. It was shown 
that minor modifications to the legacy overthrust implementation were not sufficient to achieve this goal. 
Instead, a significant redesign of the control mode logic that more explicitly accounts for disk/blade 
failure was required. The performance of the redesigned control mode is robust to flight conditions but 
dependent upon availability of measurements or estimates of the conditions within the high-temperature 
regimes of the engine (e.g., high-pressure turbine inlet/exit). The design objective was applied to the 
faster response control mode by requiring a consistent level of compressor stall probability while 
improving engine dynamic response. Probability of stall was characterized by applying a normal 
distribution-based statistical stall margin assessment. It was found that, with some tuning based on this 
statistical assessment procedure, the legacy fast response control architecture performed satisfactorily 
across various flight conditions. Since overthrust and faster response control modes modify 
fundamentally separate aspects of engine performance, the modes could be combined without conflict. 
Engine performance using the joint implementation reflected characteristics of both control modes. 

This work alluded to several relevant topics worthy of further discussion and investigation. It is 
important to note that although the design process presented is relatively generic, the control modes 
demonstrated are specific to both the elevated risk level selected and the risk models utilized. The risk 
level of 10“ 3 was arbitrarily selected for demonstrative purposes. The determination of a realistic elevated 
risk level must be based on analyses of vehicle survivability for a range of emergency flight scenarios. 

The control mode architectures described in this paper can readily accommodate other risk levels, albeit 
with a recalculation of the relevant parameters (e.g., risk boundary, minimum stall margin). However, the 
architectures are specific to the risk models utilized. Using significantly different risk models would 
almost certainly require a redesign of the control mode logic in order to preserve consistent enhanced 
performance. A possible area of future study is the usage of engine performance estimation techniques in 
conjunction with the performance-enhancing control modes. The results presented in this paper showed 
that knowledge of high-pressure turbine temperatures, especially at HPT inlet, is essential to consistent 
overthrust performance. Similarly, availability of stall margin data would allow a more direct 
implementation of the faster response mode. A redesign of the control mode that is analogous to that done 
for overthrust would eliminate the interpolation routines and increase robustness to flight conditions. 
Performance estimation algorithms such as Kalman filtering may be able to provide the data required for 
such implementations. However, the uncertainties associated with estimation techniques must be 
accounted for in the risk models. Another issue to consider is the human factors impact, if any, of 
consistent risk elevation (as opposed to consistent performance enhancement). As evidenced by the 
results, a consistent elevated risk level results in varying percentage increases in maximum thrust. Since 
these control modes are designed for emergency situations, it is essential to evaluate whether or not this 
variation affects a pilot's ability to fly the aircraft. 
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A design concept is presented for developing control modes that enhance aircraft engine 
performance during emergency flight scenarios. The benefits of increased engine 
performance to overall vehicle survivability during these situations may outweigh the 
accompanied elevated risk of engine failure. The objective involves building control logic 
that can consistently increase engine performance beyond designed maximum levels based 
on an allowable heightened probability of failure. This concept is applied to two previously 
developed control modes: an overthrust mode that increases maximum engine thrust output 
and a faster response mode that improves thrust response to dynamic throttle commands. 
This paper describes the redesign of these control modes and presents simulation results 
demonstrating both enhanced engine performance and robust maintenance of the desired 
elevated risk level. 


Nomenclature 


C-MAPSS40k 

= 

Commercial Modular Aero-Propulsion System Simulation 40k 

EPR 

= 

engine pressure ratio 

FAA 

= 

Federal Aviation Administration 

HPC 

= 

high-pressure compressor 

HPT 

= 

high-pressure turbine 

LPC 

= 

low-pressure compressor 

LPT 

= 

low-pressure turbine 

max 

- 

maximum 

min 

= 

minimum 

Nc 

= 

core speed 

W 

= 

fan speed 

OT 


overthrust 

PC 

= 

power code 

PLA 

= 

power lever angle 

PR 


pressure ratio 

PR S 

= 

stall pressure ratio 

Ps30 

- 

combustor inlet static pressure 

R 

- 

Rankine 

R 2 

= 

goodness of fit 

RPM 


revolutions per minute 

RU 


ratio unit (ratio of fuel flow rate to Ps30) 

SM 

= 

stall margin 

T40 

= 

HPT inlet total temperature 

T48 

= 

LPT inlet total temperature 

T50 

= 

LPT exit total temperature 
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VBV 

VSV 


variable bleed valve 
variable stator vanes 


I. Introduction 

C OMMERCIAL aircraft engines are designed to abide by strict safety standards. Enforced by regulatory bodies 
such as the Federal Aviation Administration (FAA), these requirements impose limits on the probability of 
various types of engine component failure. These limits are manifested as restrictions on engine operating variables 
such as rotational speeds, temperatures, pressures, and stall margins. However, in certain emergency flight 
scenarios, it may be more beneficial for overall vehicle survivability if certain safety parameters were relaxed to 
allow for non-standard usage of the propulsion systems. For example, a runway incursion event may cause a sudden 
reduction in available takeoff distance . 1 In such cases, it may be advantageous to have the option of temporarily 
increasing engine thrust output beyond the designed maximum level despite the accompanied elevated probability of 
powerplant failure. Moreover, there have been several instances of in-flight airframe malfunction or damage where 
flight crews resorted to engine throttle modulation to maintain aircraft control . 2,3,4 Such incidents have motivated 
research studies on throttle-only flight control, which identified the relatively slow dynamic response of gas turbine 
engines as one of the difficulties encountered . 5,6 Engine transient response is generally limited by conservative 
control algorithms designed to prevent compression system instabilities. However, in dire situations, a higher risk of 
compressor stall or surge may be an acceptable concession for increased thrust responsiveness. 

These considerations have motivated recent studies into intelligent risk management-based flight and propulsion 
control architectures . 7 Computer simulations of commercial-type turbofan engines were used to devise and assess 
methods of achieving additional engine performance . 8,9 Excess thrust output (overthrust) can be obtained by 
extending the control system target parameter (setpoint) beyond its default maximum value and relaxing spool speed 
and/or temperature limits. Engine transient response can be enhanced by modifying the controller bandwidth and 
acceleration schedule. Additionally, May et al . 10 developed a novel control mode known as “high speed idle,” which 
improves transient performance by allowing the engine to operate at higher spool speeds while at idle thrust output 
levels. 

Complementary studies have been conducted to evaluate the risks of implementing the aforementioned control 
techniques. Litt et al . 11 describe statistical methods that may be used to quantify the heightened likelihood of rotor 
disk/turbine blade failures and compressor instabilities due to overthrust and enhanced transient operation, 
respectively. Utilizing the underlying principles of these probabilistic methods, a somewhat qualitative risk 
assessment of the overthrust and faster response control modes was conducted at various engine operating 
conditions . 12 McGlynn et al . 13 demonstrated through simulation the concept of a risk management architecture that 
combined this assessment of engine risk (due to enhanced performance) with one of situational risk (due to the 
specific nature of the emergency, e.g., vertical stabilizer damage). The two risk parameters were balanced to 
determine the conditions required for optimal (i.e., minimum) overall risk of an emergency scenario. Csank et al . 14 
documented a preliminary implementation of the overall control architecture, which integrated the enhanced 
performance control modes with the risk management logic. 

The objective of the previously developed control modes was to achieve enhanced engine performance based on 
the selection of a range of allowable risk. However, these risk levels were qualitatively designated (e.g., low risk, 
medium risk, etc.). Hence, although it was shown that usage of the control modes resulted in a higher probability of 
engine malfunction, the magnitude of this increased likelihood at each risk level relative to that of normal engine 
operation is quantitatively ambiguous. Moreover, it is unclear from the previous studies whether or not the control 
modes consistently provided enhanced performance within the selected risk range across various operating points 
within the flight envelope. This paper presents and demonstrates, through use of a detailed computer simulation of a 
generic turbofan engine, a simple philosophy for designing and implementing these emergency engine control 
modes. At the crux of this concept is an a priori design decision: specification of an elevated and quantitatively 
meaningful probability of engine failure that is above levels representative of typical engine operation yet deemed 
acceptable during emergency flight scenarios. Since the analysis required for this specification is situation- 
dependent and, hence, beyond the scope of this work, a notional elevated risk threshold was adopted for illustrative 
purposes. Subsequently, the objective of the control mode algorithms is to constrain engine operation near but 
within this threshold when activated. The resulting engine performance represents the maximum enhancement 
achievable while satisfying these elevated constraints. The aforementioned overthrust and faster response control 
algorithms were leveraged and (at times, heavily) modified to demonstrate these notions. 
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II. Design Objective 


The design of emergency control modes is centralized around the notion of improving engine performance at the 
cost of elevating the probability of failure. The types of engine failure under consideration should be particularly 
relevant to the nature of the performance parameter to be enhanced. Namely, the failure mode should correspond to 
the “weakest link” of the engine when operating beyond design capacities (see Ref. 1 1 for more details on this 
concept). For instance, the risk of turbine blade failure due to continued exposure to higher-than-normal 
temperatures is more pertinent to an overthrust control mode than one for faster dynamic response. 
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Figure 1. Notional illustration of emergency control mode performance. 


This concept is best illustrated through a generic example. Figure 1 shows a collection of fictional risk data for 
some particular engine failure type. The black squares represent the probability of failure occurrence while operating 
the engine at the maximum attainable baseline performance for various operating points. As illustrated by this 
example, the risk of engine failure is expected to vary with operating conditions (altitude, Mach number, etc.). 
However, a maximum allowable probability for various failure types is generally defined by a regulatory body and 
cannot be exceeded. In this example, suppose the guidelines dictate that the probability of failure may not exceed 
10" 5 (blue dashed line). 

For the emergency control modes, the designer must decide on an acceptable elevated failure rate. This increased 
threshold should be chosen such that overall vehicle survivability (for the emergency scenarios relevant to the 
control mode under consideration) is improved despite the higher risk of engine failure. The details of this balance 
between vehicle and engine risk is beyond the scope of this paper. However, McGlynn et al. 13 provide examples of 
similar analyses. The elevated risk level depicted in Figure 1 is 10" 3 (orange dashed line). The control mode should 
then be designed such that engine performance is increased until the elevated failure probability level is met. The red 
circles in Figure 1 represent the performance of a nearly ideal implementation of the hypothetical emergency control 
mode featured in this example. The risk of failure is consistently raised to approximately 10" 3 at every operating 
point. 


III. Engine Simulation 


J=L_ 


The demonstrations of the control modes developed 
according to this objective are conducted using a turbofan 
engine simulation called the Commercial Modular Aero- 
Propulsion System Simulation 40k (C-MAPSS40k). 15 
C-MAPSS40k is a zero-dimensional, nonlinear, dynamic 
model of a generic commercial aircraft engine implemented 
in the MATLAB/Simulink environment. The modeled 
powerplant is a 40,000-pound thrust class, high-bypass, 
dual-spool, turbofan engine. Figure 2 summarizes the layout 
of the major engine components. The fan and low-pressure 
compressor (LPC) are powered by the low-pressure turbine 
(LPT) through a low-speed shaft, and the high-pressure 
compressor (HPC) by the high-pressure turbine (HPT) via a 
high-speed shaft. The combustor model consists of a slight 


Fan Tip 




Figure 2. Layout of major turbofan engine 
components modeled by C-MAPSS40k simulation. 
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total pressure loss and an enthalpy rise based on the lower heating value of the fuel. The rotating components are 
modeled using unique performance maps (e.g., pressure ratio as a function of mass flow rate and corrected speed). 
Scaling factors, known as “health parameters,” for several map variables are available for each rotating component 
to simulate component faults or degradation. An overall engine deterioration level (ranging from 0 to 1) is available 
to automatically adjust these health parameters to model performance changes throughout the life of the engine (0 
represents 50-hr engine; 1 represents end-of-life engine). The effects of variable stator vane (VSV) positions are 
accounted for by the HPC performance maps. There are two sources of compressor bleed air: a variable bleed valve 
(VBV) controls flow from the LPC to the bypass duct; HPC flow is used for turbine blade cooling and customer 
bleed. The rotational speeds of the two shafts are the state variables of the system, allowing for simulation of 
transient engine operation. 

With the exception of ambient temperature and pressure, which are determined by flight conditions (altitude and 
Mach number), inputs to the engine model (fuel flow rate, VSV position, VBV position) are computed by a 
comprehensive control system. VSV and VBV commands are scheduled on sensed engine parameters such as spool 
speeds and inlet conditions. The control architecture for determining fuel flow (Figure 3) is more involved. The 
throttle command from the pilot, in degrees of power lever angle (PLA), is converted into a demanded value, or 
“setpoint,” of engine pressure ratio (EPR), which is the ratio of LPT exit to fan inlet total pressure. A scheduled- 
gain, proportional-integral, feedback controller calculates the fuel flow rate required by the engine to attain this 
demanded EPR level. The fuel flow signal is then passed through a series of limit regulators, which impose 
maximum and minimum restrictions on its value. This protection logic maintains the required nominal performance 
and corresponding risk of failure below the defined threshold, preventing engine malfunction due to issues such as 
combustor blowout, overspeed, and compressor stall. The resultant fuel flow signal is sent to an actuator model (not 
shown) that meters the appropriate flow rate to the engine. 



Figure 3. Control system for C-MAPSS40k engine simulation. 


IV. Overthrust Control Mode Design 

This section presents the design of an overthrust control mode according to the process described previously. 
The objective of the overthrust control mode is to operate the engine at thrust levels beyond the designed maximum 
level while conforming to a predefined acceptable probability of engine failure. Since the engine would be operating 
beyond normal thresholds, this failure risk would necessarily be higher than that for typical usage. Furthermore, this 
elevated failure probability determines the amount of additional performance the control mode can achieve. A brief 
overview is given of the legacy overthrust control algorithm that is used as the starting point for this work. For more 
detailed descriptions, the reader is referred to documentation of the control mode’s original development. 9,12,14 

A. Risk Function 

In order to build the overthrust control mode, it is necessary to characterize the probability of engine failure as a 
function of operating conditions. For simplicity, in this demonstration, we will consider only failures of compressor 
and turbine disks and turbine blades. The failure model, or “risk function,” used for this work is documented in Litt 
et al. 11 It is important to note that although the risk function is based on published data, the values generated should 
be considered representative. The model calculates the probability of disk failure as a function of operation time and 
the size and rotational speed of the disk. The metric used throughout this work is failure probability per flight hour; 
hence, operation time is set to one hour for all risk calculations in this study. Using the output values of fan speed 
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(Nf) and core speed ( Nc ) from C-MAPSS40k, the failure rate can be calculated for each disk corresponding to a row 
of compressor or turbine blades. The failure rates are then combined into a single risk value using basic probability 
theory (i.e., probability of at least one disk failing). Probability of turbine blade failure is determined by applying 
relationships between material life and stresses from exposure to high centrifugal force and temperature. 
C-MAPSS40k does not model blade row performance. Instead, a linearly progressive extraction of enthalpy that 
empirically accounts for blade cooling flow is assumed, along with the component inlet and exit temperatures, to 
approximate the temperature at each blade row. Thus, the availability of shaft speeds (Nf Nc) and temperatures at 
the HPT inlet (T40), LPT inlet (T48), and LPT exit ( T50 ) is sufficient to estimate the failure rates of all turbine 
blades. Again, the failure rates are combined into a single blade failure risk value (i.e., probability of at least one 
turbine blade failing). The disk and blade failure probabilities can be further combined into an overall failure risk 
(i.e., probability of failure of at least one disk or one turbine blade). This parameter is used to guide the overthrust 
control mode design. 



Figure 4. Rotor disk/blade risk function tested at operating points across the flight envelope. 
Situations requiring overthrust are expected to occur at low-altitude/low-Mach number conditions. 
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Figure 5. Rotor disk/blade failure rates as calculated by risk function across flight 
envelope and operating life range of engine. 


To ensure the risk function produces reasonable results, failure rates were calculated for the engine operating at 
maximum power (80.5° PLA) across both its flight envelope and operational life range. The risk function was 
applied at the altitude/Mach number combinations shown in Figure 4. For each point in Figure 4, variations were 
applied to the standard ambient temperature (0, +20°R, and +40°R from standard day) and the engine deterioration 
level (0, 0.5, and 1), for a grand total of 1,251 test points. The results, shown in Figure 5, are within FAA 
regulations, which allow a rate of occurrence of 10" 7 to 10" 5 per flight hour for such failure types assuming they are 
contained (i.e., debris does not rupture through the nacelle). 16 

For overthrust mode design, we defined the acceptable elevated failure level as 10" 3 per flight hour. Namely, an 
ideal overthrust control mode would provide thrust levels that would result in a shift of each operating point shown 
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in Figure 5 to 10" 3 . In practice, however, situations requiring enhanced engine performance are expected to occur at 
low-altitude and low-Mach number conditions (Figure 4). Hence, the control modes described in this work are, 
when applicable, tailored to this portion of the flight envelope. It follows that the results presented henceforth in this 
paper are primarily focused on this smaller operating regime as well. 

B. Modified Legacy Implementation 

This section describes the attempt to modify the legacy overthrust control algorithms 9,12 to conform to the design 
objective prescribed in this work. The primary appeal of both the original and this modified approach is that they 
require minimal modifications to the baseline control architecture (Figure 3). The previous implementations of 
overthrust involved extending the EPR setpoint tables beyond the default maximum levels corresponding to 80.5° 
PLA. The EPR setpoint tables are used to convert PLA to EPR demand by interpolating between the setpoint flight 
conditions. The extended EPR setpoints corresponded to approximately 120% design maximum thrust output. The 
maximum fan and core speed limiters were disabled to allow this additional performance. 

The objective of this modified implementation is to provide overthrust while maintaining a consistent level of 
failure risk for a variety of operating conditions. Therefore, the risk function was used to reselect the elevated EPR 
setpoints. A set of 36 operating points at low altitude and Mach number (altitudes of 0, 2000, and 4000 feet; Mach 
numbers of 0, 0.15, and 0.3; ambient temperature deviations of 0°R and +40°R; deterioration levels of 0 and l ) was 
chosen as extended setpoints for this approach. At each point, the engine was run with all maximum limiters 
deactivated except those for spool acceleration and combustor static pressure ( Ps30 ). EPR was then incremented 
until either the risk function indicated a failure probability of 10" 3 or Ps30 reached its maximum allowable value (the 
Ps30 maximum limit prevents combustor failure, which is unaccounted for by the risk function). The resulting EPR 
values are saved as the elevated setpoints for overthrust operation. 
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Figure 6. Modified legacy overthrust implementation: failure probabilities. 
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It is assumed that engine deterioration level is known from sources such as maintenance logs detailing number of 
hours since overhaul or health estimation/management techniques. 
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Figure 7. Modified legacy overthrust implementation: net thrust improvements. 

This approach was tested at 180 different flight conditions within the range of the extended EPR setpoints 
(altitudes of 0 to 4000 feet in 1000-foot increments; Mach numbers of 0 to 0.3 in 0.1 increments; ambient 
temperature deviations of 0°R, +20°R, and +40°R; deterioration levels of 0, 0.5, and 1). Figure 6 compares the 
probability of failure for operating the engine at maximum power with and without overthrust at each of those flight 
conditions. Figure 7 shows the percentage increase in net thrust at each operating point.* As expected, the level of 
additional thrust varies greatly with the flight condition — from approximately 4% to over 20% of baseline maximum 
thrust output. However, the overthrust mode designed using this modified method still performs poorly in terms of 
consistently delivering performance at the desired elevated failure risk of 10" 3 . Analysis of the data revealed that the 
primary contributor to the lack of consistency is the fact that the maximum Ps30 limit was reached before a failure 
rate of 10" 3 could be achieved for several of the extended EPR setpoints. This essentially invalidates the basic 
premise of using setpoint interpolation for a large portion of the operating envelope covered by these points. 
Furthermore, even for portions of the flight envelope where the Ps30 limit was not reached, the uncertainties 
introduced by interpolation manifested as relatively large deviations in failure rates. This issue was attributed to the 
high sensitivity of the failure model to certain engine parameters — an important observation to be elaborated upon in 
subsequent sections. A denser set of extended setpoints may alleviate this latter limitation but would not address the 
primary problem of Ps30 limit activation at some of the setpoints. 

C. Risk Boundary 

In an effort to obtain more consistent risk levels during enhanced performance operation, a new approach to 
overthrust was developed. This design places more emphasis on the disk and blade failure model. The premise is to 
calculate a boundary that represents a constant level of failure probability (in this case, 10" 3 ). This boundary can be 
visualized as a surface in the multi-dimensional space defined by the input variables of the failure model. For 
instance, since the risk function used in this work requires five inputs {Nf Nc , T40 , T48 , T50 ), the boundary would 
ideally be a five-dimensional surface on which the failure probability remains constant at 10" 3 . The overthrust mode 
would then manipulate the control system to maintain the operating point of the engine on this boundary. 

In order to simplify the definition and visualization of this failure boundary, the dimensions of the input space 
were reduced. To do so, the risk function was analyzed to identify the inputs it is most sensitive to. Furthermore, 
disk failure and blade failure were investigated separately. Recall from Section IV- A that the disk failure model 
requires spool speed inputs {Nf Nc) whereas the blade failure model requires spool speeds and turbine temperatures 
( T40 , T48 , T50). Not surprisingly, even in the neighborhood of maximum engine power operation, both functions 
were particularly sensitive to Nc and relatively unreactive to Nf due to the large difference in rotational speeds 
between the fan and core shafts. The analysis concluded that neglecting Nf would not have a significant impact for 
this work. For the disk failure calculation, this simplification reduces the model to a single-variable function (Figure 
8). Hence, imposing a particular maximum allowable disk failure probability involves simply restricting Nc to the 


For the presentations of engine performance and risk at multiple operating conditions in these and subsequent 
figures, the operating points are not ordered in a physically meaningful fashion (unless explicitly stated otherwise). 
Therefore, observations will focus on the overall consistency of the performance and risk delivered by the control 
mode. No conclusions will be drawn about how engine performance — baseline or enhanced — trends with flight 
conditions. 
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corresponding value. For example, a 10" 3 probability of at least one disk failure corresponds to core spool operation 
at over 13,200 RPM. 



Core Speed, RPM 

Figure 8. Probability of disk failure as a function of core speed (neglecting fan speed). 



Core Speed, RPM 

Figure 9. Simplified boundary representing 10" 3 probability of blade failure in terms of 
core speed and T50 (neglecting fan speed and using linear correlations for T48 and T40). 

The situation is more complicated with the blade failure model due to the turbine temperatures. Although the 
function is expectedly more reactive to the temperatures closely related to the hotter segments of the engine (in order 
of most to least sensitive: T40 , T48 , T50 ), it is sufficiently sensitive to all three variables such that none could be 
neglected. Thus, in an attempt to reduce the three temperatures to a single input value, a correlation study was 
conducted on steady-state turbine temperatures across the entire operating regime of the engine (at the 1,251 
operating points described previously). It was found that the temperatures were highly linearly correlated; Table 1 
summarizes the quality of the linear least-squares fits ( R 2 ) between different temperature pairs. Hence, knowledge of 
one temperature value can provide approximations of the other two. By using these correlations and neglecting fan 
speed, the input dimension of the blade failure risk function can be reduced to two (core speed and a turbine 
temperature). As an example, Figure 9 shows a failure boundary of 10" 3 calculated in terms of core speed and T50. If 
the temperature correlations were perfect, operation on that threshold would result in a 10" 3 probability of at least 
one turbine blade failing. The regions to the left and right of the boundary correspond to lower and higher risk 
levels, respectively. 

Table 1. Quality of linear least-squares fit between turbine 
temperature pairs. 


Correlation 

Goodness of Fit ( R 2 ) 

T40 & T48 

0.9955 

T40 & T50 

0.9598 

T48 & T50 

0.9739 
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For this work, the elevated allowable probabilities for disk and blade failure were both set to 10" 3 . Although this 
may theoretically result in a maximum probability of approximately 2xl0" 3 for overall failure (i.e., failure of at least 
one disk or blade), in practice, the two probabilities were orders of magnitude apart when operating at design 
maximum (or beyond) thrust levels. Spool speeds and turbine temperatures are interdependent parameters obtained 
by balancing a multitude of aerothermodynamic relationships. Simultaneous maximization of disk and blade failure 
probabilities (to 10" 3 ) would require the contradictory scenario of operating at high core speeds (defined by Figure 8) 
and low turbine temperatures (to abide by the relationship in Figure 9). In other words, only a segment of the 
temperature/speed boundary depicted in Figure 9 is realistically attainable. Hence, the elevated limit for overall 
disk/blade failure risk is still effectively 10" 3 . 

It is important to note that, ideally, LPT exit temperature ( T50 ) should be used as the temperature input to 
determine the risk boundary since, of the three, it represents the most hospitable environment for sensor placement. 
Temperature measurements at the LPT inlet (T48) are available for certain aircraft engines. 17 However, HPT inlet 
temperature ( T40 ) is not typically measurable and would require performance estimation techniques. Nevertheless, 
we will analyze examples of overthrust using each of the three temperatures. As the results will illustrate, despite the 
highly correlated temperature relationships, the differences in R 2 values — albeit small — coupled with the high 
sensitivity of the failure model to the hotter turbine temperatures noticeably impact overthrust mode performance. 

D. Implementation with Risk Boundary 

Before examining the new overthrust control architecture, the transition process between normal and overthrust 
operation is briefly considered. Recall that in the C-MAPSS40k simulation, PLA is mapped to a set of target EPR 
values. PLA may also be interpreted as the physical position of the throttle component in the aircraft cockpit. Thus, 
extending the allowable range of PLA values for the purpose of overthrust is not practical. Instead, it is envisioned 
that the overthrust mode would be controlled via a dedicated button or switch. However, since this new overthrust 
mode is based on failure risk as opposed to EPR, a redefinition of the PLA-to-EPR mapping would be ambiguous. 
As a result, an intermediary power level indicator, known as power code (PC), is introduced. The PLA-to-EPR 
mapping within C-MAPSS40k is reformatted into a PC-to-EPR mapping. The relationship between PLA and PC is 
shown in Figure 10. During normal operation, the full range of PLA (40° to 80.5°) is mapped to PC values of 0 to 
100. However, upon activation of the overthrust mode, PLA is matched to PC values of 0 to 110. The 
correspondence between the EPR setpoints and PC values from 0 to 100 is consistent for both normal and overthrust 
operation. PC values greater than 100 activate the overthrust mode, with a PC of 1 10 representing the thrust output 
at the maximum allowable elevated risk level of 10" 3 . 



Power Lever Angle, deg 

Figure 10. Mappings from PLA to power code to facilitate transitions 
between normal and overthrust operation. 

The architecture of the risk boundary-based overthrust control mode is shown in Figure 11. Blocks outlined in 
black represent the baseline control system components whereas those in red indicate new components for 
implementing overthrust. The purpose of the overthrust mode is to calculate the fuel flow rate required to drive the 
engine operating point to the designated risk boundary. The control mode consists of three primary components: a 
core speed limiter, the risk boundary data, and a temperature limiter. The core speed limiter ensures that, even 
during overthrust, an absolute maximum value on core speed is not exceeded. This limit is defined by the disk 
failure risk of 10" 3 . Concurrently, the pre-calculated risk boundary data (Figure 9, for example) is used to determine 
the maximum allowable turbine temperature for a given core speed. This temperature limit is recalculated as core 
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speed varies. The temperature limiter determines the fuel flow required to drive the engine to that limit value. The 
minimum of the two limiter outputs is taken to ensure neither the disk nor blade failure threshold is violated. 




Figure 11. Control mode architecture of overthrust implementation with risk boundary. 


The remaining components introduced facilitate the transition process between normal and overthrust operation 
as described at the beginning of this section. The mapping from PLA to PC is dependent upon the mode of 
operation. For PC up to 100, the fuel flow rate is determined entirely by the baseline EPR controller (and the fan and 
core speed limiters). Between 100 and 110, the fuel flow signal sent to the remainder of the control system is a linear 
combination of the contributions from the EPR controller and the overthrust mode, weighted on PC. At maximum 
overthrust, or a PC of 110, the baseline fan and core speed limiters are essentially neglected and fuel flow rate is 
solely calculated by the overthrust mode. However, similar to the legacy overthrust implementation, the Ps30 limiter 
and acceleration schedule remain in the loop since the risk function does not account for their associated failure 
modes. The minimum limiters are preserved as well since they are not relevant to overthrust operation. 

The question remaining is which of the three turbine temperatures to use with the overthrust control mode. The 
subsequent subsections present the results and issues associated with each case. 


1. T50 

This subsection presents the results of using T50 with the overthrust control architecture. As previously noted, 
this selection is the most practical since LPT exhaust gas temperatures are typically low enough to be readily 
measurable. This implementation is tested on the same 180 low altitude/low Mach number operating points 
described previously. Figure 12 shows the location of each operating point, with full overthrust, relative to the risk 
threshold by plotting T50 against Nc. As the results indicate, there are several flight conditions where the maximum 
Ps30 limit was activated before the risk boundary was reached. These points represent flight conditions where a 
failure probability, as calculated by the risk function, of 10" 3 is not achievable due to the hard Ps30 limit; for these 
points, maximum overthrust is determined by the Ps30 limiter and usually corresponds to risk levels noticeably 
lower than the desired 10" 3 value. Most of the test cases (approximately 70%), however, fall onto the risk boundary 
as expected (note that the boundary shown in these results is a small section of the boundary depicted in Figure 9). 
Figure 13 shows the changes in net thrust from the design maximum output due to the overthrust mode. (For clarity, 
in these and subsequent figures illustrating overthrust mode performance, the operating points are ordered such that 
those with an active Ps30 limiter are plotted first.) The control mode achieved an increase in net thrust of 10% to 
25% at nearly all 180 operating conditions regardless of the Ps30 limiter status. 
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Figure 12. Overthrust implementation with Nc-T50 risk boundary: operating points 
relative to risk boundary. 



Operating Point 

Figure 13. Overthrust implementation with Nc-T50 risk boundary: net thrust improvements. 

Despite the apparent success of this implementation suggested by the results in Figure 12, the actual failure 
probability levels for the test points are not necessarily close to 10" 3 . Figure 14 shows the risk level for each run 
(before and after overthrust activation). These results confirm that the failure probabilities for most of the cases with 
an active maximum Ps30 limit remain well below 10" 3 . However, the failure probabilities for the operating points on 
the risk boundary are inconsistent, varying by approximately an order of magnitude in both directions. This scatter is 
a result of the uncertainty created by collapsing the risk boundary into two dimensions. Recall that, in this case, the 
boundary was simplified by approximating T40 and T48 using the linear least-square fits. Unfortunately, the high R 2 
values of these fits are overshadowed by the sensitivity of the failure model to the hotter turbine temperatures — T40 , 
in particular. Figure 15 shows failure probability plotted against T40 error (difference between the actual T40 value 
and the T40 value calculated by applying the linear fit equation on T50 ) for only the points situated on the risk 
boundary. The test cases with small T40 discrepancies indeed exhibit failure rates close to the desired 10" 3 level. 
However, a 20°R error in T40 corresponds to approximately an order of magnitude change in probability of failure. 
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Figure 14. Overthrust implementation with Nc-T50 risk boundary: failure 
probabilities. 



T40 Error, R 

Figure 15. Overthrust implementation with Nc-T50 risk boundary: sensitivity of failure 
probability to T40 error. 


These results suggest that a risk boundary of lower failure probability should be used with the control mode if 
only T50 data are available. A more conservative boundary may be able to contain failure risk below the required 
level but will result in less-than-maximum performance in most cases. Alternatively, measurements or estimates of 
T48 or T40 could be utilized, which will be discussed in the subsequent section. 


2. T48&T40 

Although the implementation with T50 data performed noticeably better than the modified legacy method in 
maintaining the desired elevated risk level (Figure 14 and Figure 6, respectively), there is ample room for 
improvement in terms of consistency. To address this issue, usage of the hotter turbine temperatures (T48 and T40 ) 
with this overthrust mode design was investigated. Because these temperatures represent harsher operating 
environments, they are not readily obtainable in all aircraft engine applications. Ref. 17 suggests T48 is measurable 
for certain powerplants. However, T40 is generally unobtainable using conventional sensing devices. The 
implementations and results presented in this section assume either the availability of a T48 sensor or an accurate 
onboard estimation technique for T40 data. Measurement/estimation uncertainty was not analyzed, though, as shown 
by the results obtained using the T50 implementation, it would likely affect control mode performance. 

Figure 16, Figure 17, and Figure 18 show the results of applying the overthrust control mode using T48 data for 
the 180 test points. Figure 16 shows the 10" 2 3 failure rate boundary presented in terms of Nc and T48. Similar to the 
implementation with T50 , for each run, the control mode increased thrust output until the engine was limited by 
either the maximum allowable Ps30 value or the risk boundary. Figure 17 summarizes the percentage increase in net 
thrust over the design maximum output levels. However, in this case, as shown in Figure 18, the actual failure 
probabilities of the runs situated on the risk boundary are distributed more closely around the 10" 3 level (standard 
deviation of approximately 0.34><10" 3 ). 
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Figure 16. Overthrust implementation with Nc-T48 risk boundary: operating points 
relative to risk boundary. 
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Figure 17. Overthrust implementation with Nc-T48 risk boundary: net thrust improvements. 
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Figure 18. Overthrust implementation with Nc-T48 risk boundary: failure probabilities. 


The primary cause for this deviation, albeit reduced, is the same as before: high sensitivity of the failure model to 
T40. Therefore, it follows that the failure probability consistency was further improved by utilizing T40 data with 
the overthrust control mode (Figure 19, Figure 20, and Figure 21). For this case, the standard deviation of the failure 
probabilities for those points located on the risk boundary was reduced to 0.066><10" 3 . This tighter distribution 
indicates that the Nc-T40 boundary is a more accurate approximation of the true (i.e., five-dimensional) constant 
failure rate threshold than the others. It is interesting to note that there are no significant differences among the three 
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implementations with respect to thrust output enhancement. The primary advantage of the availability of the hotter 
turbine temperatures is more fine-tuned authority by the control mode over the failure probability. 
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Figure 19. Overthrust implementation with Nc-T40 risk boundary: operating points 
relative to risk boundary. 
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Figure 20. Overthrust implementation with Nc-T40 risk boundary: net thrust improvements. 
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Figure 21. Overthrust implementation with Nc-T40 risk boundary: failure probabilities. 

Although more complex than the legacy overthrust control mode architecture, this novel implementation is 
robust to flight conditions since its design is primarily based on the risk function. To demonstrate this (disregarding 
whether or not overthrust functionality would be useful at all such conditions), the control mode using T40 data was 
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applied at the aforementioned 1,251 test points across the entire flight and engine health range of operation. 
Increases in net thrust output range from 2.5% to 36% (Figure 22). Figure 23 shows that, with the exception of the 
cases with an active Ps30 limit, the desired elevated risk level is consistently maintained at all test points. 
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Figure 22. Overthrust implementation with Nc-T40 risk boundary (full envelope): net thrust 
improvements. 
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Figure 23. Overthrust implementation with Nc-T40 risk boundary (full envelope): failure 
probabilities. 


V. Faster Response Control Mode Design 

Application of the design method presented in this work to a faster engine response control mode requires 
identifying the type of malfunction to focus on and characterizing the probability of it occurring. This demonstration 
will concentrate on the risk of high-pressure compressor (HPC) rotating stall/surge (henceforth collectively referred 
to as “stall”) since the primary function of the faster response mode is to shorten engine acceleration times. Stall 
likelihood is captured by stall margin (SAP), which is generally defined as the proximity of the operating pressure 
ratio (PR) of the compressor to its stall pressure ratio (PR S ) for the same operating mass flow rate: 

SM = - l) x 100% 

In C-MAPSS40k, the compressor maps and their corresponding surge lines are definitive quantities. Thus, it is 
usually assumed that stall does not occur if the stall margin is positive. However, in practice, there are uncertainties 
affecting both the operating and stall lines of a compressor that cannot be deterministically captured. If these random 
factors are accounted for, then the risk of stall exists even if the engine model reports a positive stall margin. The 
risk parameter used for the faster response control mode is this probability of HPC stall. 

A. Risk Function 

A statistical stability assessment is used to capture stall probability. The specific procedure and examples 
described in the “SAE AIR1419 Rev. A” guidelines document 18 are leveraged for this work. Table 2 reproduces the 
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data from the sample stability assessment provided by the document. The table enumerates factors that affect the 
operating and surge lines and provides approximations of how much stall margin is required to account for each. 
The sum of the non-random stall margin effects is an indication of the minimum design stall margin of the 
compressor. These factors are assumed to be accounted for in the design of the C-MAPSS40k engine model. Only 
the random effects are of interest for determining stall probability. 

Table 2. Statistical compressor stability assessment. 18 



Destabilizing Effects 

Non-random 

Random 

Operating Line 

Inlet Distortion 

0.7% 

- 


PLA Transient 

6.0% 

- 


Fuel Control Tolerance 

- 

±1.15% 


Engine-to-Engine Variation 

- 

±1.25% 

Surge Line 

Reynolds Number 

0.36% 

- 


Inlet Distortion 

7.5% 

- 


Engine-to-Engine Variation 

- 

±1.35% 

Total 


14.56% 

2.17% 



Stall Margin, % 

Figure 24. Stall margins of a large fleet of engines modeled as normal distribution. Stall margin 
reported by C-MAPSS40k (1% in this illustration) represents mean performance. Area under curve 
from negative infinity to 0 equals probability of stall. 

The premise of the risk function is that the deterministic engine model, C-MAPSS40k, represents the mean 
performance of a large operating fleet of such engines. Deviations from this mean performance are approximated by 
a normal distribution function. The risk function calculates the stall probability by applying this assumption to stall 
margin. The offset and shape of the probability density function is defined by the deterministic and random stall 
margin effects. Specifically, the HPC stall margin output from C-MAPSS40k is set as the mean of the normal 
distribution. The random stall margin effects are combined using a root-sum-square calculation, resulting in the 
overall 2.17% value shown in the last line of Table 2. This root-sum-square is assumed to equal three standard 
deviations, thus defining the shape of the normal distribution curve. For instance, Figure 24 shows the stall margin 
distribution for a mean stall margin of 1%. The probability of stall at this particular operating condition is then 
obtained by calculating the area under the density function from 0 to negative infinity. These calculations are 
repeated for various values of mean stall margin to generate the risk function, visualized in Figure 25. 

For consistency with the overthrust control mode, a risk threshold of 10" 3 was selected for the design of the faster 
response control mode. This risk level corresponds to a stall margin of approximately 2.4%. As Figure 25 shows, the 
risk of stall is negligibly small for stall margins above 5%. Since the baseline engine consistently operates (during 
transients and at steady-state) at HPC stall margins well above 5%, the performance of the faster response control 
mode will be presented in terms of stall margin as opposed to stall probability. 
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Mean Stall Margin, % 

Figure 25. Probability of stall due to random destabilizing effects as a function of 
mean stall margin (reported by engine model). 


B. Implementation 

The legacy control mode implementation improved transient response by introducing three primary 
modifications to the engine control system. 10 First, the bandwidth of the EPR controller was increased to provide 
faster response for small PLA transients. Second, a novel high-speed idling technique manipulated customer bleed 
and stator vane schedules to attain higher spool speeds at low thrust levels. This operating state reduces the time 
required for the engine to reach higher power levels. Finally, the acceleration schedule was shifted to increase the 
limit on maximum allowable core acceleration, improving large transient performance at the cost of increased stall 
margin usage. 

For the present implementation, the controller bandwidth modifications and the high-speed idle algorithms were 
largely preserved. However, since the acceleration schedule plays a major role in regulating the stall margin usage 
during a large power transient, the offset logic was tuned using the stall risk function. A simple search algorithm was 
created to determine the offset amount that yielded a minimum stall margin of 2.4% during a 0.1-second flight idle- 
to-full power throttle change. This search was conducted at 60 operating points covering a low-altitude/Mach 
number flight regime (altitudes of 0 to 4000 feet in 1000-foot increments; Mach numbers of 0, 0.1, and 0.2; 0°R and 
+40°R deviation from standard day ambient temperature; deterioration level of 0 and 1). Control mode usage within 
this envelope involved four-dimensional interpolation between these operating points to determine the appropriate 
offset value/ 
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Figure 26. Faster engine response implementation: minimum stall margin attained during transient. 


A more direct method — analogous to the risk boundary overthrust implementation — would be a minimum limiter 
on HPC stall margin. Such an approach would require stall margin estimation (e.g. Kalman filter, model prediction, 
etc.) and, hence, is beyond the scope of this paper. However, the design philosophy presented in this paper is well- 
suited for this approach and implementation of such a configuration is a possible avenue of future work. 
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To test the control mode, the same throttle transient was run at 540 operating points (altitudes of 0 to 4000 feet in 
500-foot increments; Mach numbers of 0 to 0.2 in 0.05 increments; standard day temperature deviations of 0°R, 
+20°R, and +40°R; deterioration levels of 0, 0.3, 0.7, and 1) evenly distributed across the flight envelope defined by 
the 60 interpolation points. Figure 26 shows the minimum HPC stall margin observed during each run for the 
baseline control system and the faster response mode. The baseline cases exhibit a wide range of minimum stall 
margin values, indicating that the dynamic response is highly sensitive to ambient and engine health conditions. 
Nevertheless, the acceleration schedule performs its intended function, maintaining an often sizeable stall margin for 
all cases. With the faster response mode activated, this excess stall margin is consumed to improve transient 
performance. The control mode is relatively consistent in maintaining the desired minimum stall margin. 

The decrease in repeatability for the cases in the 180-360 range is due to interpolation of offset values across 
standard day temperature deviations. The 540 points in Figure 26 are grouped in order of increasing ambient 
temperature: the first third represents standard day ambient temperature; the second third is +20°R deviation; the last 
third is +40°R deviation. Since the interpolation points only consisted of conditions at 0°R and +40°R deviation, 
these results imply a nonlinear variation with standard temperature that is not being adequately captured by linear 
interpolation. It is expected that additional interpolation points at more temperature values would alleviate this issue. 
On the other hand, control mode performance across variations in altitude, Mach number, and engine health appears 
to be sufficient. 
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Figure 27. Faster engine response implementation: rise time improvements. 

Figure 27 shows the improvements in dynamic thrust response by using the control mode in terms of percentage 
reduction in rise time. For this application, rise time is defined as the time the engine takes to traverse from 10% to 
90% of the difference between the initial and final thrust output levels. The faster response control mode achieves a 
5% to 20% reduction in rise time for the majority of the test cases. 

VI. Joint Implementation 

The overthrust and faster response control modes operate on different components of the engine control system. 
As Figure 1 1 illustrated, the overthrust mode manipulates the limit protection (min/max) logic to incorporate the 
elevated risk boundary. On the other hand, the faster response mode modifies parameters within the EPR setpoint 
controller and acceleration schedule subsystems. Thus, the effort required to combine the two performance 
enhancing modes is minimal: the modifications introduced by each mode are superimposed without conflict. 

Likewise, engine performance when utilizing both emergency control modes is essentially a superposition of the 
results already presented for each control mode individually. This is because the two control modes seek to modify 
fundamentally separate portions of the engine response. To elucidate, Figure 28 shows the net thrust and HPC stall 
margin time responses to an idle-to-full-power throttle command for a particular operating condition (1000-foot 
altitude, Mach 0.2, +20°R deviation from standard ambient temperature, 0.7 deterioration level). Four cases are 
presented: (1) both control modes deactivated (i.e., baseline); (2) overthrust mode only (using T40 data); (3) faster 
response mode only; (4) both control modes activated (with overthrust mode using T40 data). For the baseline and 
faster response-only cases, throttle was increased from flight idle to full power in 0.1 seconds at the 15-second mark; 
for the overthrust-only and combined implementation cases, throttle was increased from flight idle to frill overthrust 
in 0.1 seconds at the 15-second mark. As shown by the results, the overthrust mode primarily affects the conditions 
at which the engine settles. The transient portions of the baseline and overthrust only cases are similar until the 
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overthrust mode commands a higher thrust. On the other hand, the faster response mode significantly alters the 
dynamic response of the engine in the form of a shorter rise time and increased stall margin usage. However, the 
faster response and baseline cases settle to identical conditions. The joint implementation exhibits the characteristics 
of both control modes. The dynamic portion of the response resembles the faster response time history since the 
combined implementation drops to a similar minimum HPC stall margin. The response then settles to the same 
thrust level as the overthrust case. 


4 
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Figure 28. Engine performance using combined implementation exhibits characteristics of 
both overthrust and faster response control modes. 

The results shown in Figure 28 are representative of the enhanced performance obtained throughout the low- 
altitude/low-Mach number operating regime described in the previous section. Figure 29 shows the minimum stall 
margins attained during a 0.1 -second transient from flight idle to maximum overthrust at the same 540 operating 
points used to test the faster engine response mode. In this case, the joint implementation is compared with an 
overthrust-only configuration. Figure 30 summarizes the rise time improvements at those operating points. The 
results are similar to the comparisons between the baseline control system and the faster response control mode. 
Plots of steady-state net thrust improvements and increased disk/blade risk levels using the joint implementation are 
identical to the overthrust-only configuration (Figure 20 and Figure 21). 
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Figure 29. Combined implementation: minimum stall margin attained during transient. 
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Figure 30. Combined implementation: rise time improvements. 



VII. Summary & Future Work 

This paper described and demonstrated a design philosophy for developing engine performance-enhancing 
control modes for use during emergency flight scenarios. Performance improvements are defined and limited by a 
predetermined elevated risk of engine failure that is deemed acceptable for such situations where overall vehicle 
survivability must be maximized. This concept was demonstrated on two previously studied enhanced engine 
performance modes: overthrust and faster response. The overthrust control mode must be able to consistently 
provide increased maximum engine thrust output at a predefined elevated probability of rotor disk/blade failure for a 
variety of flight conditions. It was shown that minor modifications to the legacy overthrust implementation were not 
sufficient to achieve this goal. Instead, a significant redesign of the control mode logic that more explicitly accounts 
for disk/blade failure was required. The performance of the redesigned control mode is robust to flight conditions 
but dependent upon availability of measurements or estimates of the conditions within the high-temperature regimes 
of the engine (e.g., high-pressure turbine inlet/exit). The design objective was applied to the faster response control 
mode by requiring a consistent level of compressor stall probability while improving engine dynamic response. 
Probability of stall was characterized by applying a normal distribution-based statistical stall margin assessment. It 
was found that, with some tuning based on this statistical assessment procedure, the legacy fast response control 
architecture performed satisfactorily across various flight conditions. Since overthrust and faster response control 
modes modify fundamentally separate aspects of engine performance, the modes could be combined without 
conflict. Engine performance using the joint implementation reflected characteristics of both control modes. 

This work alluded to several relevant topics worthy of further discussion and investigation. It is important to note 
that although the design process presented is relatively generic, the control modes demonstrated are specific to both 
the elevated risk level selected and the risk models utilized. The risk level of 10" 3 was arbitrarily selected for 
demonstrative purposes. The determination of a realistic elevated risk level must be based on analyses of vehicle 
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survivability for a range of emergency flight scenarios. The control mode architectures described in this paper can 
readily accommodate other risk levels, albeit with a recalculation of the relevant parameters (e.g., risk boundary, 
minimum stall margin). However, the architectures are specific to the risk models utilized. Using significantly 
different risk models would almost certainly require a redesign of the control mode logic in order to preserve 
consistent enhanced performance. A possible area of future study is the usage of engine performance estimation 
techniques in conjunction with the performance-enhancing control modes. The results presented in this paper 
showed that knowledge of high-pressure turbine temperatures, especially at HPT inlet, is essential to consistent 
overthrust performance. Similarly, availability of stall margin data would allow a more direct implementation of the 
faster response mode. A redesign of the control mode that is analogous to that done for overthrust would eliminate 
the interpolation routines and increase robustness to flight conditions. Performance estimation algorithms such as 
Kalman filtering may be able to provide the data required for such implementations. However, the uncertainties 
associated with estimation techniques must be accounted for in the risk models. Another issue to consider is the 
human factors impact, if any, of consistent risk elevation (as opposed to consistent performance enhancement). As 
evidenced by the results, a consistent elevated risk level results in varying percentage increases in maximum thrust. 
Since these control modes are designed for emergency situations, it is essential to evaluate whether or not this 
variation affects a pilot’s ability to fly the aircraft. 
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